Top story
What Qwen’s 30-minute reverse-engineering demo actually proves https://www.xda-developers.com/qwen-3-8-27b-reverse-engineering-job-frontier-model/
Seventeen gigabytes of VRAM is the number that made me stop. In one local run, Qwen 3.8 27B scanned thousands of lines of ARM64, rebuilt a public key hidden in a binary, and produced a license-bypass proof of concept in about 30 minutes. The author reports roughly 50 tokens per second on a Lenovo PGX with SGLang, NVFP4, and DFlash2. That puts a serious security task inside one consumer-class machine.
What makes the demo credible to me is the failure in the middle. The first key passed the signature check, failed an integrity hash, and the model kept working until the bytes matched. A strict oracle can expose confident nonsense. djoldman made the same point on HN: agents improve most on tasks with clear tests. jchw asked for the missing harness and tool details, which is the right caveat. If you evaluate local models, copy the test design before you copy the model choice. One clean run is evidence, not a capability class.
Two tabs I kept
The $114 Fire HD with a $266.15 AI bill https://ericpardee.github.io/fire-hd-ownership/
Four models, five months, and $266.15 of AI later, one developer rooted a $114 Fire HD and removed about 100 Amazon packages with reboot or shutdown power. I would not call it a cyber benchmark: the flaw was public in 2022, the device missed a 2024 patch, and the author knew InfoSec. I would copy the HANDOFF.md and the recorded checks, not the shopping strategy.
Let repeated review comments write your agent.md
https://fabiensanglard.net/agent.md/index.html
Fabien Sanglard’s agent.md starts with review comments he got tired of repeating: narrow diffs, fewer magic numbers, failing tests first. My version would be smaller. After the second repeat, save the rule with its scope and reason. Delete it when it stops preventing a real defect. Do not import another maintainer’s preferences as universal law; Sanglard still reviews every change.
One thread
Today’s useful pattern is simple: an agent needs a hard test, and the next session needs a record of what already failed.
— Tin